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(54) Method and apparatus for free previews of communication network services 

pi-tl t QH i U- ra 3fiCHA l*cjy:i:;; TP. t 
{ ;«u^ — - ~* — — ----- A consumer is :: illbw^^pi^^ without pur- 

chase, portions of the video "service' at any time during 
.the fixed "period .for up to a, maximum preview duration 



(57) Limited duration previews of prograjm offerings 
available : for purchase via ^communication Network are 
provided in i ^^(^aphfc^lly Secure manner at virtu- 
ally any timeduring the service. The invention has par-' 1 
ticuiar applicability to the provision of video services on 
a pay-per-view basis. Such a video service is provided 
during a program epoch (PE). A fixed period (72-74) is 
defined during the program epoch (72-78) when portions 
of the video service are available for viewing on a preview 



(82j that is Shorter than trye : ffxecl period (72-74). The con- 
sumer can then purchase^the video service for viewing 
during the program epoch (72-78) after previewing por- 
tions thereof. A plurality of records (90, 92, 94, 96, 98) is 
maintained to service different previewable programs 
concurrently. 
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Description \; > 

BACKGROUND OF THE INVENTION 

The present inventfoh relates to communications' ' 5 
networks such as cable television/satellite television arid 
computer networks over which 1 services are available" for ' 
a fee/ and more particularly to a method and apparatus 
for providing free previews of individual program offer- 
ings (e.g., a movie) prior to purchasing that offering/ io 

Cable and satellite television networks where video 1 
services are available for a fee are well known. Also well 
known are computer network services such as Com- 
puServe, Prodigy, America Online, Dialog Information 
Service, and others where databases; banking and 75 
shopping services can be accessed and e-mail and the , 
like can be communicated, all for a fee. In the past, some" - 
communication networks : have : provided : services on a ' 
free trial basis. For example, pay per view television mov- 
ies, in which a viewer can order a movie for viewing upon '20 
payment of a fee. have sometimes enabled viewers to - 
watch the first five minutes or so of the movie on a jxe- *• 
view basis before purchase is required. Such previews 
were limited to a predefined time period at thebeginnirig I 
of the movie. Free previews were not available at any 25 
other time:during the broadcast of the movie. { - 

The provision of a limited free preview at any time 
during the broadcast -of *~a service (such as a ; movie) 
would be 'desirable from a consumer's Standpoint: For 
video services, a viewer would not be constrained to hav- 30 
ing a preview Only at the beginning of the program, which 
may not be a convenient time for the viewer; However, 
the provision of a limited duration free preview at any timfe 
during the availability of a service is fraught with danger 
from the standpoint of the service provider: In particular, 35 
opening up a service to free previews at any time may 
make it possible for an unscrupulous viewer or "pirate* 
to defeat the security of the signai and obtain the entire 
service without charge.-* 

It would be advantageous to provide a method- and *o 
, apparatus for allowing a* limited duration free preview it 
virtually any time during the provision of a service. It 
would be further advantageous to provide such a method 
and apparatus that are riot easily taken advantage of by 
unscrupulous customers or pirates. Such a method and 45 
apparatus should maintain signal security while provide 
ing the flexfoility of an "anytime free preview" (AFP). It 
would also be advantageous to provide such a method 
and apparatus that' enable a viewer to switch back and 
forth between one or more AFPs (each associated with so 
a different service) and conventional programming 1 . Each- 1 
AFP would be limited to its own particular ^ maximum AFP 
duration. Such a system must remain secure at all times 1 
and prevent a viewer' from -obtaining free previews for : 
more than the maximum duration assigned to the partic- r 55 
ular service. -The present invention provides a method r 
and apparatus having the aforementioned and other 
advantages. 



SUMMARY OF THE INVENTION 

A method in accordance with the present invention 
provides video services to consumers via an information 
network! A video service is provided on a pay-pef-view 
basis during a program epoch. A fixed period is defined 
during the program epoch when portions of the video 
service are available' for viewing on a preview basis. A 
consumer is allowed to preview, without purchase, por- 
tions of the video service at any time during the fixed 
period for up to a maximum preview duration that is 
shorter than the fixed-perioid. The maximum preview 
duration is preferably enforced in a cryptographically 
secure mariner- In particular, 1 a record can be maintained 
in a cryptographically secure manner to indicate the 
amount of unused preview' time remaining for the con* 
sumer to view the video service during the fixed period r f 
The fixed period during which portions of the video serv- 
ice are available for previewing, as well as data identify- 
ing whether a preview is available for a particular service', ' J 
are also preferably maintained in a cryptographically 
secure* manner. . ' ; ' 

In a preferred embodiment, the method of the invent 
tion enables a consumer fo purchase the video service 1 
for viewing during the program epoch 'after^previewing 
portions of the- service'. Also in the preferred erribodi- 
merit* the program epoch is divided into a plurality of f 
working key ; epochs (WKE's): 7 A count of We WKEVis ' 
ayptographlcally' 1 authenticate 
TOurit^'ksefr^^ (i.e., define arid keep track 

of) said maxirhum preview duration. 1 ■••<■ v * * - y 

The method can further coriiprise the steps of main*" 
taining a record Of services whichthe consumer has pre- 
viewed durihg r prior program epochs. The consurner is 
"frien prohibited from previewing a service during a cur- 
rent prograrri epoch if the'consurrier has previewed any' 
parfof that service during ~a prior program epoch. This 
prevents a consumer from recording successive tree 
previews in order to accumulate a full movie brother pro- 
gram for viewing. Trie record of services which the con- 
sumer has previewed during prior program epochs can * 
be maintained in a cryptographically secure manner. 

in an illustrated embodi ment, up to Kl active records 
of previewable serviced can be : rriairitained at a time. 
Each record conriprise&either a purchase record r^pre- ' 
senting a previewable service that has been purchased 
by the consumer or a preview record representing a serv- 
ice that the consumer has selected for preview. The Expi- 
ration- of an- active * : previewable service record is 
prevented until the program epoch for the service repre- 
sented by that record is Over. The expiration tifrie is con- 
trolled by an expiration timer. Alternatively, the expiration 
can be prevented by establishing a fixed minimum time 
period (e g. "several hours) for each record. The fixed" 
"minimum record duration is longer than theTongest serv-" 
ice that has a free preview available. ' c - 

The method of : the -present inveritbiV can also 
include the step of preventing the erasure of any preview 
record'uritil the pr6gram : epoch for the service repre- 
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serrted thereby is over. In the illustrated embodiments 
preview record is converted to a purchase record upon 
purchase by the consumer of the service represented, by 
the preview record. At the time of conversion, th^ pur- 
chase record is rendered irrevocable, in such an embed- 5 
irnent, the erasure of any preview record is prevented pcrct 
until 'the program epoch tor the service represented 
thereby is over, except that a preview redound can be . 
erased by conversion to an inevpc^ble piirctiasejfecprd. . , 

Whenever all N records of previewable services $re >. 10 
active, additional previews are denieq^to lhet consumer,, ? 
However, a consumer can still purchase a . service, in 
which event one of the preview records will [ be pverw^t-v 1. - 
ten with a purchase record. Preferably, the next to expire 
preview record willbe^the one.that is overwritten. When is 
a preview record j$ open, the consumer can pe informed ^ 
of how much unused preview^ime remains for the corre-r - 
spond^ng video service. 

Apparatus in accordance with theprese/rt invention; i« 
provides previews^ of services, available f or-purchase via 20 
a communication network. First means process data ~ 
received from the communication network. The.data (i)_ 
identifies a service { avail arple for purchase; - (ii) identifies 
a period pf time (epoch) over which the service i§ pro- fr 
vided, (iii) indicate^ whether a preview is available for the, .25 
service,,and (iy) provjd^ inforrnatton necessary tp gen?j -or. 
erate keys jbr en^ling^jarv €UJthpr^d : :go^sufT\eir t tjh -».-.-. 
receiv%tb£ service of, 3 jtf^ 

responsive to ^e fin^^ar^whe^apre^iew if v avaj]ctoi£< v 0 
for thjje servic.fi, are, provWed : ipr fceepinQ track ©t&fbcejd \ <j3p 
period during the epoch r when previewing is permitted.^ 
A user interface .cooperates with the? first and second 
means for enabling a consumer to preview portions^of , B j 
the servjee at any time during the jixed period ,ft>r up4o 
a maximiim prev-iew duration that is shorter; tharj the fixed as 
period.. The us^r interface also enables- a^nsufner to f ^ 
purchase the service. Means are -responsive to the4irst 
means for decrypting the s^icexluring a preview arid; ; 
after a purchase -thereof. , , c 

the apparatus in accordance w}t^ the invention can , ; 40 
further comprise means^fpr enforcing the.maxiiTwnjpre-, . 
view duration in a cr yptographipally secyr$ .runner. The. . 
apparatus can maintain a record '.in 1 a ^r^ptographically 
secure manner tp indicate the amount of unused preview ~ 
time remaining for ftie consumer to view the service dur- 45 
ing ttief ixed p©ric£. • : ^,.r^ ? ] (JS \ ^ 

Means can be provided for, r^irr^mipg up to N r : 
active records pf n prew Each 
record comprises either a purchasq/egord representing, ~ 
a previewable service that ha§ been, p t u rehashed by, the so 
consumer or a preview record representing a servteejthat , ^ 
the consumer has selected for preview. M^ans ace prp;j r 
vided for preventing the expiration \ s qf fx\ active preyieyy- r ^ 
able service record until. the program, epoch for the 
service represeni^d by that record is, over. Mea^i&can Sss 
further be provided for preventing the erasure qf any pre- , 
view record until the program epoch for, the service rep- 
resented, thereby is ov^r. Inan illustrated errbodiment, . ; 
means are provided for converting a preview record. to a 



purchase record upon purchase by the consumer of the 
service represented by the preview record. The pur- 
chase record provided by the converting means is ren- 
dered irrevocable. Except for possible conversion to an 
irrevocable purchase record, the erasure of any preview 
record is prevented until the program epoch for the serv- . 
ice represented thereby is over. , * Vi . v ^ . 

The apparatus otttie invention can further comprise 
means for denving any previews or previewable services 
to the consumer whenever all- N previewable, service ; 
records are active. Means* caft' also be provided for 
informiog the consumer of how, much unused preview 
time remains for each service. s • • » ^ 

In an illustrated embodiment, the epoch.over which 
the service is provided is divided into a plurality^ work- 
ing key epochs. A cryptographjcally authenticated count 
of the wprking key epochs is used to implement -said . 
maximum preview duration. Means are provided for fur- 
ther cryptographically authenticating at least the portion 
qf the date that identifies whether a preview is available 
for said service, and the fixedrperiod during which pre- 
viewing is permitted. >.~ . ^ ■ < • 

BRIEF DESCRIPTION OF THE DRAWINGS -?t 

■ • . , . » -i vi* •» - & ■ •* 

Figure 1 is a Woc^diagra^of apparatus in acpord- 

arrce with the pre^rt^nyentfon;} > u; ■ 

gigy re %js,a bfogkcliagram Uiustfratii^tte^Jecryspticfi- 

hi^rafQ^iy - used ^in :j acco5C(anse : with Jtbe?ipresient ; 

iijventiOQv'ig f,^rr • . ; a. v ^ ve<v 

Rgure S is a time jine, illustrating different program. 

epochSrthat occur overctime-.r » 

figure . 4 is a; diagf ^mmatic ill ustration of. one prp- r 

gram^epoch, illustrating various bouncferies con:. 

^ tain§d therein, and a sample of the working key 
epochs (WKE's) that occur during the program 
epoch; , ? - * . : 

Figure 5 is a diagrammatic illustration of various pre- 
vi ew/program records that are maintajned in accord- 

*. 4 ance with the invention;- r v:*: f .x: \* t 

Figure 6 is the first partpf a flowgh^irt illustrating the : 
authorization of ,-^nytirne free previews: in accord- 
.ance with the pr^^ irw^njionaanct ^ A . 
figure 7 ; is a coratinuation Qftheflowch^rtpf figure 6; 

DETAILED DESCRIPTION OF THE INVENTION 

•Figure 1 illustraj45S, : in >blQck, .diagram, form, the 
decryption. portion, of a digital satellite, or. pable .television 
receiver or tiie like^ An, encrypted services r( e.g., a pre- 
mium television service) i^^input to terminaf 10. By the/ 
timethe bitstream conprising the service is input-to ter- 
minal 10, it has already been received and demodulated 
from the communication channel oyer which it is trans- 
emitted, using cpnventional -techniques.. fThe encrypted 
service is decrypted by a decryption processor .12 in 
order to provide a cleaF signal at output 1 &of the decryp- 
tion processor. 
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The decryption processor can utilize a conventional - 
decryption scheme, such as that disclosed in Gilhousen, 
etal. US. patent 4,613,901 entitled "Signal Encryption 
and Distribution System for Controlling Scrambling antf 
Selective Remote Descrambling of Television Signals, - 5 
or Bennett et al. U.S. patent 4,864,615 entitled "Reprd- 
duction of Secure Keys By Using Distributed Key Gen- £ 
eration Data,". both incorporated herein by reference. *- 
The decryption processor requires working keys (WK) in> 
order to decrypt the signals input thereto via terminal 1 0. • * to 
The working keys are generated by a secure processor 
20 in response to control signals received via input/out- : 
put (I/O) terminal 30. Firmware for the secure processor =. 
is stored in read only memory (ROM) -24. The secure 1 
processor is also provided with random access memory 75 
(RAM) 22 in ^conventional manner.<A secure portion of. 
RAM 22 holds unit specific keys and/or seeds for usein 
decryption of a monthly key, as discussed in greater 
detail in connection with Figure 2. • . : 0 

A user interface 26 enables a viewer to select serv- 26 
ices for viewing on a television (TV) 28. If a user is author- - - 
ized to receive the selected service by subscription or 
individual purchase (e.g:, pay per view), secure proces- 
sor 20 will actuate switch 1 8 to couple the decrypted out- 
put 16 from decryption processor 12 to the TV 28 via 25 
user interface 26. Otherwise, the user; interface arxPTV 
will only, receive the encrypted signal via line *<1 4 and 
switch 18:. .-^^rc : % ■, <♦ - • ;-to s '.-/--v. ;b':o 

A typicatkey hierarchy is-illustrm^irvFigure 2: Ah» " ;c;? 
encrypted program pre-key is input via terminal 40 to a ^36 
decryption function 44 which also receives a monthly key " 
via terminal 42. The program pre-key is unique to each - 
encrypted program offering (e.g., television program) ; 
that is available -for decryption. The monthly fey f is v 
changed on a periodic basis ? e.g., once each month. The 35 
decryption function 44 decrypts the encrypted program 
pre-key to provide a program pre-key that is used as one 
input to a one-way function 48. The other input to one 
way function 48 cx>mprises various^program attributes, v M 
including access requirements, for the corresponding '<§ 
program; The access requirements must be met in order -* : - 
to obtain authorization to view the program. The program r - 
attributes are input via terminal 46, and the one way func- 
tion processes • the program pre-key and program ~ * ; 
attributes to provide aprogram key. The program key but- : 4& 
put from one way function 48 is used as one input to * * 
another one way function 52 that also receives, via ter- A " : ' 
minal 50, an initialization vector (IV) representative of 
time, The processing of the initialization vector and pro- T 
gram key by one way function 52 generates the working so 
keys required by decryption processor 12 (Figure 1) to ' 
decryptthe service selected by an authorizetfuser. A fur- - f 
ther description' of .the^generatibn of the various keys, 
including working keys(provided in a "keystream"). can - 
be found in the aforementioned Bennett, et a!, patents 55 

Figure 3 is a diagrammatic illustration of the initiali- 
zation vector that is input to terminal 50 of one way func- 
tion 52, The initialization vector 60"comrhences at v ' 
time = I and runs until time = J , which canbe.for exam- v : 



pie, several weeks,-at which time the count resets. During 
the time represented by the vector 60, a plurality of pro- 
gram epochs (PE, through PE n ) bccur. Each program 
epoch can be of a different length, and is associated with 
one program offering. 

Figure 4 is a diagrammatic illustration of one pro- 
gram ^poch, generally designated 70. Thle ejx>ch starts 
at time 72 and ends at time 78. Prior to the end of t&T 
epoch, there is an AFP boundary 74 and a program 
boundary 76. The 'time between the start of the 1 epoch 
72 and ther AFP'boundary 74 is a fixed period during the 
Program epoch when portions of the program are avail- 
able for viewing ori a preview basis. During this fixed 
period, the program can be previewed for a maximum 
AFP duration 82. As indicated by arrows 84 and 86 in 
Figure 4, the AFP can be viewed at' any time from the 
start of the" epoch to the AFP boundary, but only for up 
to the maximum AFP duration T provided. In order td 
permit a viewer to view some part of the allowed free 
preview time, tune Naway, and then return to watch the 
remaining part, the maximum AFP duration 82 is main- 
tained as a count of working' keys which is decremented 
as the allowable AFP time is used up. 

During a program epoch, Working keys are gener- 
ated for authorized subscribers that have purchased or, 
. during a preview period; requested a preview of the pro- 
gram. Th e~ program ' epoch is- d ivided into a plurality of 
working key epocihs OAfKE's) r S6, as illustrated in figure 
4. Fbr exar^lb; tKd wbrftngfey epbch^ may occur at a.^ 
rate of eight WKE's per seddnd,' or tix any othe^ ihtervatl 
that is desirable for a given irhpilementatidri of the sys- 
tem. The' WKE's can provide a convenient frieans for 
maintaining the integrity of the AFP boundiary 74. in a' 
preferred embodiment; the AFP boundary is the Value of 
the WKE representihg tiie boundary beyond which an 
anytime free preview is riot allowed. This parameter Is 
authenticated by including it in the program key genera- 
tors. Thie cdmptitatiorv and 1 maintenance of the AF^P 
boundary is discussed in greater detail below, in conneb f 
tion with Figures 6 and 7. 

The program boundary 7& is the point hi which the 
program provided during the epoch is expected to end. 
The end bf the epoch 78 may extend beyond the program 
boundary 76 : to accommodate the possibility of a pro- 
gramTunnjng over ite original expected length. For exam- 
ple, if a program is^hterrupted by a riew£ bulletin, the 
program ending tinhe may be extendeb. Similarly, since 
it is impossible to accurately predict the end df a sports 
event, it may be necessary to etf ehd the 1 program bound- 
ary within the program epoch to acdommodate agarhe ' 
that runs' into overtime *' - v * J ~ 

Iri accordance' with the* present iiWefttiqh, no free 
previews afe pea-niitfedaft^r the AFP boundary 74. Thus, 
during 1 the pbirtbh- of a program that run^ between the 
AFP bbtfridary 74' and the epoch end 78. free previews 
can ndt be ofctairted. The reason for providing tfie AFP 
boundary is to defend against certain attacks by a #rate 
who Attempts to use the AFP feature in order to obtain a 
program or service without proper payment. In particular, 
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a pirate may attempt to change the time at which a pro- v : . 
gram epoch ends in order to obtain free services. . How- 
ever, this will not help. him steal successive anytime free 
previews, because the* AFP boundary is an authentic .x? 
cated value beyond which free previews will not be avail- 5, 
able. Further, as explained in greater detail below, the 
present* invention establishes "records" of prevjews and s „ 
purchased programs, which are not allowed to expire. . 
prematurely in a way that would be helpful to a pirate. 

In order to prevent the theft of services by taking 10 
advantage of the anytime free preview, feature, the 
secure processor 20 (Figure 1) of the present invention . 
securejy regulates the duration of a program segment , 
that may be viewed without purchase. In order, to accom- 
plish this, the anytime free preview duration is main- 15 
tained in units of working key epochs. The sequre = 
processor 20 counts the jiumber of free working keys 
generated, When the count reaches a limit established ;; 
by the maximum AFP duration 82 (Figure 4), the author- 
ization state is changed frqrn "cain buy or obtain <a free 20 
preview" .toucan buy only." The AFP duration is one of 
the program attributes that is included in the generation^ < 
of the program key. Thus, it can not be altered wjthout : ., 
altering, the program key itsieH, which vyguld prevent ;the, 
correct decryption of thje program. %s 

As mentioned above Jr; the system, of titie pr^ser^t ^ 
invention establishes a recorder e^h^i^am pre- r<r .;, . 
viewed or pijrchased. Onpe tte usen^og^s to jp^ 
AFR> "preyjew reccjdr iKgreated ^ecu^ppocesr . J=? ? . 
sor 26 to define the number oifree worlang keys,allowed ; ^3$ 
and tq keep r glreal time counter to pause-the .record to 
expire when the event or program is over, the timer must 
continue to run whether or not the receiver is synchro- 
nized to a scrambled or encrypted waveform, so that 0 
records expire at the proper time. If an £FP record were 3$ 
to expire early, , a second free viewing period could be - . 
taken. If the record expires fate, no harm is done but the . 
number of new free preview.offerings is reduced during , 
. the existence of the record beyond the end of the pro- ... 
gram. ; ■ , ao 

In accordance with ttpe presem. invention, up to N 
multifunction records are maintained. Each record is 
either a "preview record", representing an anytime free 
preview selected by ttiexiser, a "purchase record? repre-, ... . .... 

serrting a program that the user has bought or an inactive - 45 
(null) record., ^so, jn^ccordancewi^ Jh^e present inven- ... 
tion, it is not possible for. a fyevi^record for a given r r 
event to be erased before the event is oyer,. exc,ept by, a " . < 
legitimate purchase of the .event or another purchasable 
service, in which case the record ii^erwritten tqprov/ide v so 
a purchase record. Typically, a user will* request a free . 
preview, and tjien decide whether, or pot to.purchiase the 
event based on the fnee preview. Hf the event is not put: ., >: 
chased, the.preyiew record is maintained until the end of 
the event unless another service is purchased .to ever- - ss 
write it If the user decides to purchase the event, then , v 
the preview record is converted to a purchase record,. 

Preventing the erasure of a preview record before f 
the event is^byer is. an essential feature of the present 



invention. If preview records were merely stored in af irst- 
in first-out queue (FIFO), older records would be lost as 
new records are added. A user could then cumulatively 
watch rpore than the free preview limit by scanning 
through and watching one second* of a humbec of pro- 
grams; to flush -the queue, and then return, to watch 
another freepreview of the desired program. This oppor- 
tunity is precluded by the maintenance of each preview 
record for the entire event once the preview record is 
established. .'. - ■ <\ 

Also in accordance with the invention, program pur- 
chases take precedence over free preview offerings. In 
a case where all N available preview/purchase records 
are active, and at least "one record holds an AFP, the 
secure processor 20 will indicate the authorization state 
as "can buy." The reason for this is that even though all 
of the available preview/purchase records are in use, one 
of the active preview records can be replaced by a pur^ 
chase record. Preferably, the preview record that is 
replaced by the^purchase record will be the one that is 
closest to, expiring. . . r,. ■* ^ 1 

It is also important to carefully control any opportu- 
nity for a ; user to erase a preview.record. since the ability 
to erase such a record provides an opportunity for abuse . 
For eygmptei a program that is "purchased" may have 
been .created by <aj pirate-in hisowairterest./Therefore, 
in thQ case wher,e aprpgeam purchase (he., a purchase* 
record) overwrites a preview record, the present inven-* 
tion provides various defenses.- First, a purchase which, 
overwrites a preview re^djrwdves a secure; transfer of 
debit jn which the-debfetotal of the user's decoder is 
increased by^e* program a>str~ The number of pur- 
chases made is^lsQ^counted in a secure manner. Sec- 
ond, the purchase record itself remains in memory until 
the purchased event is over. In this manner^ the Tecord 
is not available for another anytimsiree previewxintil the 
termination of thepunshased event, f . 

If a program selected for purchase is the program 
defined by a preview record, then jtfoat record is (Simply 
converted to a purchase recond and the record temains 
open. After a preview recQrd has been, activated, a sub-, 
sequent purchase of that program will be irrevocable. In 
this manner, ; the record for;, the program., cannot -be 
erased. As a further precaution, the secure processor 20 
establishes a minimum expiration tjme>foc a.purchase 
record. This minimum time cartbe, for example, on the 
order of one hour, and will frustrate potential attacks by 
a pirate that attempts to, cause an early expiration of. a 
purchase record.. . . ; ,,r, . <* - to y* ; 

Timing of program durations and. anytime free pre- 
view periods is maintained ^y secure processor 20. A 
real tim£ program expiration counter is maintained in the 
secure processor for this purpose. Program durations 
and AFJP periods: can be givemin units of working key 
epochs.-.- 7 • %. ? «:v'..t * * .' 

As.indicated above, ajset otmultifunction records is* 
maintained in the^secure processor 20 to handle anytime - 
free previews and purchased programs. A set of N such 
preview/program records is illustrated diagrammatically 
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in Figure 5. The records 90, 92, 94, 96 and 98 each .; 
include program attributes (including access require- 
ments>forthe particular program or event that the record - 
pertains to. A preview record will also maintain a count sh 
of the time remaining (e.g. . number of free workingckeys -r 5 
remaining) within the maximum AFP duration for watch-: j 
ing a free preview. A purchase record is rendered irrev- > . 
ocable when established after a free preview. 1 

The program attributes will comprise information ■*■"' 
such as the cost of the program, which access . require- 10 
ments.(e.g., vtiersT a user must subscribe to in order to " 
receive the program, whether an AFP is available for the - - i ■ 
program and. U so how many free working keys are pro-; v 
vided for the AFP, an initial free preview boundary if an 
initial free preview is available instead of or in addition to 15 
an anytime free preview, and various regional access 
information. Since the access requirements are authen- " - 
ticated by one. way function 48, as shown in Figure 2, N 
none of these requirements can be altered without alters . . 
ing the program key that is used to generate the working 20 
keys for decrypting the program. If the program key usdd 
to decrypt differs from the one used to encrypt, decrypt 1 
tion will fail. The inclusion of the maximum AFP duration* 
(i.e., number^ of free WKs permitted) as an access <' 
requirement authenticates, this parameter and prevents * *25 
its alteration without invalidating tine working keys; * v-? 

Each preview/purchase . records also includes a " 
record valid \f lag, a purchase flag, am expiration^ timer 
count; .and apportion of the program 5 key used as<a jSro^ocs 
gram identifier. The record valid flag can be, for example, 30 
a one bitflag. that indicates whether the recordis valid or 
not. This flag, when set indicates that the record con- 
tents are valid. When thefiag is dear, the record is cur-' 
rently undefined. \ , v 

The purchase flag indicates Mhat the record -?35 
describes a purchase record instead of a preview record. 
The working key epoch count is disregarded if the pur- 
chase flag is set. The expiration timer counts in prede- ^ 
fined units (e.g., 2.56 seconds) the time left In the- > 
program. Once the record is expired, the record valid flag *o 
is cleared. . - . .■ ^ 

The portion of She program key provided in the pre- 
view/purchase record comprises, e.g:, five bytes of the 
clear program key and is used as a program identifier. 
The working key epoch count counts the number of work- 45 
ing keys provided during the anytime free preview. »>•■ "0 

As part of the derivation of an authorization state; 
which is required to enable a userto view a program; the 
secure processor determines if a given program is view- 
able via an anytime free preview. If an AFP is offered for so 
a particular program, but all ' of the N available pre- ' : - 
view/purchase records are in use (as indicated by their 
record valid flags), a free preview cannot be granted. 

Although a preview record could be established 
each time a user tunes to a channel offering an AFR such 55 
action is not preferred. The reason is that as a user suc- 
cessively tunes to different channels (an activity known 
as "channel surfing*), programs offering AFPs will be 
successively encountered and the N available records 



will be quickly used up. Thus, the user interface 26 (Fig- 
ure 1 ) will offer the user the option to view an AFP if avail- 
able, will offer the user the option to buy a program being 
previewed. will provide the user with an indication of how 
much free preview time is left for the program, and will 
handle cases where initial free preview (an offering of a 
preview for a<Iimited duration at the very beginning of a 
program) and anytime free preview offerings interact. In 
a preferred embodiment, the user interface is provided 
via on screen displays on.theoiser's television 28. The 
generation of such on screen displays is well known in 
the art. .*> y $ ' • , ^ ' 

In general, an on screen display will be available 
when the secure processor determines that an AFP is 
available for an acquired program. The user interlace will 
collect text messages defining the AFP option screen. If 
the user selects an AFP, the user interface reports this 
fact to the secure processor 20 and free access is 
granted for up to the maximum AFP duration. In an alter- 
nate embodiment* an AFP can be automatically granted 
when a sufficient tirrie has elapsed after the user tunes 
to a particular service. - < 

In order to handle possible conflicts between an ini- 
tial free preview and an anytime free preview, it is pref- 
erable that several rules be enforced! First, if a program 
has been acquired during ah ihitiar free preview period 
(or during^ 7 preceding* epoch), thfe fact that ah AFP is 
offered shall be^disregardedllf the user chooses nof to 
purchasethe program aftd the user encounters thesame~ 
program at a later time after the initial free pWiod is over 
(i.e., after tuning away-from the "program and then back 
to the program); -then an AFP may be offered. Second, 
a program purchased during the- AFP period may never 
be cancelled. Once a purchase is made during an AFP 
period, the purchase is irhmediateand irrevocable. 

Figures 6 and 7 illustrate, in flowchart form; the proc- 
ess by which ^anytime free previews' are 1 provided in 
accordance with the present invention. The routine com- 
mences at box 100; and at box 102 a working key epoch 
message is acquired. The WKE message identifies the 
WKE count within ihe current program epdch- At box 
104, a program rekey message is acquired. As indicated 
in connection with the description of Figure 2, the pro- 
gram pre-key is required in order to generate the pro- 
gram key arid ultimately the working keys for authorized 
users. At box 106, the authorization state for the 'user &' 
computed, in order to determine' if the useV is authorized" 
to receive the program and any AFP provided for the pro- 
gram. If the user is authorized* to receive th& program, a 
determination is made at box 108 as to whether or not 
the user h&s indicated a desire to purchase the program; 
If so, a purchase record is created at box 110. Upon cre- 
ation of the purchase record- a truncated portion of the 
clear prdgram key-(6utput from one way "function 48 of 
Figure 2)1s stbred^at box 1 12. The clear program key is 
used by one way function 52 (Figure 2) to dierive the nec- 
essary working keys as indicated at bax-114. 

While the working keys are generated, a determina- 
tion is made at box 1 1 6 as to whether the prog-am epoch 
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has ended. If not, the derivation of working keys contin- 
ues and the process loops between boxes 114 and 116 
until the program epoch ends. Upon termination' of the 
program epoch, the purchase record is deleted as indi- c 
cated at box 1,-1 8. The routine then ends at box \2& i a. s 

If a program has not yet been purchased by ah 
authorized user, the routine will proceed from box 1 08 to v * 
box 122 where a determination is made as to whether 
the program epoch has ended. If so, the routine ertdsf at 
box 120. If the program epoch has not ended, a deter- 10 
mination is made at box 124 as to whether an anytime *• 
free preview is available. If not, the routine loops back to i 
box 108. v ~j > 

If an AFP is^available for the program (as indicated, ; 
for example, by a non-zero AFP count or by a separate #5 
"AFP available" bitiadetermination is r^ade at box 126 
as to whether the user has requested to,watcb=a free 
preview, tf not, the routine loops b$ck to box 108.- If an t 
AFP is requested; , the routine passes to bpx 128 of Fig- .r. 
ure 7. At box 128, a preview record is cregted Then; at j £0 
box 130 an AFP expiration counter (AEC) ^initialized. 
At box 132, the clear program key ts stored together with 
the AFP count. "The AFP county decremented with,each 
working key, and provides a record of the r emaining^ime, 
in the maximurt) AFP duration (i e ; , the arnount;Of;time;^-g5 
that the viewer left to preview the program tor free). • 

At box 1 34, ,a wprking key ^created ..and t^e; AFP z « 
count i^ 0^^ented. : .The prpgr^n^ exj^ttpnj^r^e^feie;^ 
then <^pLrt^d^0ire^tty> from th^gurorvt ; lS wef Iqn^.keyo iuq 
epocb.as indicated ,at bpx 136.t lrt thrs manne*. the. AF?P: - ap 
record expiration is dynamically recalculated every work- , ) 
ing key. In particular, a variable M ts computed where ; . , 
M = (AFP bpundary- current WKE count) . M is ^tben . . 
converted to real time musing simple .scajing. and if the *<a 
result is bigger than the AEG as determined-at box 138, . ^ 
the AEC is overwritten with the c^p<uted*exjDtratiQn time 
atbox 140, This will lengthen toe AEG.to prevent apirate 
from attempting to shorten the AEC.in order tp extinguish . „, 
a preview, recprd and obtain an additional AFP- for the - - 
prograrrw i r : - ,_o < $^ 40 

£fierjhe A£C is tested anf|.tf necessary, overwritten, , 
a determination is made, at box 144, as to whether th,e 
AFP maximum duration has expired (i.e., if the, number : 
of free, working-keys for tbe preview has been decre--- 
merited to zero). If so, any further AFrMor the program , 45 
is deauthprized at box 152. Otherwise, a determination . . 1: 
is made at box 1t46 as to whether the AFP boundary ha^ i - 
been passed. The AFP boundary is>the wprkang-key 
epoch count representing tie boundary beyond which, 
an anytime free preview is not/ allowed. As indicated ysp 
above, J? this parameter is authenticated by ind.udiog .it in . - 
the program key generators. , r >L : - -v. o c."i 

If the AF«P. boundary has b§en 6 passed, any further,- lt:i 
AFP for the program is deauthoriz^, at^^1.K: ( Qtherp: : A -> 
wise, a determination is made at box 148 -as. to> whether ss 
the AFP has been terminated^ the user If not, the rou-, : . 
tine waits for the next working key epoch (box 1 49) and - 
then a new working key is created at box 134. The routine 
then continues until . either the AFP maximum duration 
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has expired, the AFP boundary.hasbeen passed or the 
AFP isterminated by the user. Upon termination of the 
AFP by the user, the current AFPxhjration count is held 
as indicated at box 150 and nothing is done until the pro- 
gram is purchased, the program epoch ends; oran* AFP 
is again requested. The AFP duration ^oount will* enable 
the user to reinitiate an anytime free* preview during the 
program, and before the AFP boundary, until the maxi- ' 
mumAFP du^tion has expired. f ; .; 

Upon holding the AFP duration courrbafter an AFP 
is terminatecrby theuser, or deauthorizing theAFR after 
the maximum AFP duration^ has. expired: or* the- AFP 
boundary) has been passed? the routineof Figures^ and 
7 returns to box 1 08. A user can thenpurcriase the pro- 
grams service unless the program epoch has ended. . 

Jn an alternate embodiment, the maintenance of the 
AFP expiration counter and computation of the expiration 
time from the WKE*(boxes 1 30 and 1 36 to 1 40 of Figure 
7) can be/eliminated by simply setting a minimum pre- 
view, record expiration .time.^ For example, a preview 
record once^established carr be maintained for ^mini- 
mum of two hours. This will secure the anytime free prev 
viewfeatuire such that a pirate can not steal more than 
one AFP every two hours, rf the minimum preview record 
.expitat&niirrie isHonger than the longest typical program 
epoch, then either thisinethod orthe method illustrated 
in Figure Xcan beAisedto prevent the jexpiration of an 
active; previewabjeo service record until tbeitprbgram 
epocfrfofetfce service represented by that recood^s:over.r 
: ttstouldnowbe^preciat^ 
tion provides af ree preview, feature for servicesrayailable 
for a fee over a communication network. fA potentieti proV 
gram purchaser's provided with the abifty to view a Jim- : * 
ited number of minutes of a movie or other pcogramfor 
free, as : ^n enticement torpurchase the service. The" 
present invention improves upon prior art implementa-. 
tions, where only the beginning portion of a movie could 
be viewed without charge. With the anytime free preview 
feature of the present invention, previewing is not limited 
Jo the beginning of a service. The duration. otttie free 
preview is variable and may be defined on a program by 
program basis by< specifying, as- a program attribute, a 
maximum AFP .duration. Th^invention'also enables a 
user to view a portion. of an available free preview at one 
time, tune away-and then return to watch, an additional 
portion of the free preview. The use^ can break the free 
preview into as many portions as desired, as long as<the 
maximum AFP duration is not exceeded. < 

Although the. invention has, been described in con-, 
nectipn with specific embodiments thereot^those skilled 
in the art will appreciate that numerous adaptations and 
modifications may be made thereto without departing 
from the spirit and scope of the invention as set forth in 
the claims. . ; * ..vs.- ■ • ^» • ■ . - '■-•*: "■ 

Claims - r • 

1 . A method for providing video services to consumers 
via an information network; comprising the steps of: 
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providing a video service on a pay-per-view 
basis during a program epoch; 

; defining a fixed period during said program 
epoch when portions of said video service are avail* 
able for viewing on a preview basis; 

allowing a consumer to preview,- without pur- 
chase, portions of said video service at any time dur- 
ing said fixed period for up-to a maximum preview 
duration that is -shorter than said fixed period; and 

enforcing said maximum preview duration in 
a cryptographically secure manner. 

2. A method in accordance with claim 1 comprising the 
further step of: r: " 

■ enabling a consumer to purchase said video 
service for viewing during said program epoch after 
previewing portions thereof. 

* • ■■ ^' * .«-,.* 

3. A method in accordance witfr claim 1 or 2 wherein 
said program epoch is divided into a plurality of 
working key epochs (WKE's), comprising the further 
steps of: 

cryptographically authenticating a count of 
said WKE's; and 

using the authenticated count to implement 
said maximum preview duration. 

4. A method in accordance with one of the preceding 
claims comprising the further step of: 

maintaining a record to indicate the amount 
of unused preview time remaining for said consumer 
to view said video service during said fixed period; 

wherein said record is maintained in a cryp- 
tographically secure manner. 

5. A method in accordance with one of the preceding 
claims comprising the further steps of: 

maintaining a record of services which said 
consumer has previewed during prior program 
epochs; and 

prohibiting said consumer from previewing a 
service during a current program epoch if the con- 
sumer has previewed any part of that service during 
a prior program epoch. 

6. A method in accordance with claim 5 wherein said 
record of services is maintained in a cryptographi- 
cally secure manner. 

7. A method in accordance with one of the preceding 
claims comprising the further steps of: 

maintaining up to N active records of preview- 
able services at a time, each record comprising 
either a purchase record representing a previewable 
service that has been purchased by said consumer 
or a preview record representing a service that said 
consumer has selected for preview; and 

preventing the expiration of an active pre- 
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viewable service record until the program epoch for 
the service represented by that record is over! : 

8. A method in accordance with claim 7 comprising the 
5 further step of : 

preventing the erasure of any preview record 
until : the program epoch for the service represented 
thereby is over. ' ; v 

io 9. A method in accordance with claim 7 comprising the 

further steps of : ' v - 
: converting a preview record to a purchase 

record upon purchase by the consumer of the serv- 
ice represented by the preview record; and * s?: * 

is - **' rendering the purchase record resulting frdhrt 

said converting step irrevocable. 

- r 1 0. A method in accordance with claim 9 comprising the v 
further step of: "~ 

20 - - r preventing the erasure of any preview record 

until the program epoch for the service represented 
therefc>y'is ? over, except by conversion to an irrevoca- 
ble purchase recoifd. ' " 

25 11. A method in accordance with one of claims 7 Jo 1 6 
comprising the further step of: 

^ 1 denying any kiSHiond^e^ewS'tiysaid con- 
sumer Whenever air N^prfevifewarie iervibe : rdboTds . 
^active: ^ '< a \>> * ■ " " 

30 "* ' ' - : ' 

12. A method in accordance with one of the preceding 
claims Comprising the further step of : ' :J 

informing said consumer of how much 
uhused : preview time remains for said video service. 
35 : * • ■ ■ " - " -~\ 1 

13. A method in accordance with one of the preceding 
claims wherein said fixed period is enforced in a 
cryptographically secure "manner. ■ 0 ~ 

40 14. Apparatus for plrbvidi rig previews of services availa- 
ble for purchase via a communication network, com- 
prising: 1 * ' * ' : * 4 " ?< 

first rheans for processing data received from 
said communication network said data (i) identifying 

45 a service available for purchase, (ii) identifying an 
epoch over which said service is provided, (iii) indi- 
cating whether a preview is available for said serv- 
ice, and (iv) providing information rtecessary to 
generate keys* for enabli rig' an authorized consumer 

so to receive said service or a preview' th ereof ; 

second means responsive to said first means 
when a preview is available for said service for keep- 
ing track of a fixed period during said epoch When 
previewing is permitted; * 7i * 

55 - - f ■ 'a user interface cooperating wrth^ said first 
and second means for enabling a cohsumefr to pre- 
view portions of said service at any time during said 
fixed period for up to a maximum preview duration 
that is shorter than said fixed period, said user inter- 
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face also enabling a consumer ,to purchase -said 22. Apparatus in accordance with one of claims 14 to 21 

service; and ? , : wherein said user interface comprises:.. ■ 

means responsive to said first means for . , means jor informing said consumer of how 

decrypting said service during a preview and.after a much unused preview time remains for said service, 

purchase thereof. " 5 



23. Apparatus in accordance witttotie of diaitris 1 4 to 22 



15. Apparatus in.accordance with claim Mfaittercorrfc wherein said epoch is divided irftd a plurality of work- 
prising means for enforcing said maximum preview ing key epochs, a cryptographicatiy authenticated 
duration in a cryptographically secure manner. count ot which is used to implement sSTd maximum . 
r ^ ** ^ •• ■ . - . f.r. :■■ v 10 5. preview duration. 1 • r * 

16. Apparatus in accordance with one of claims 14 or < 

15 further comprising: , n 24. Apparatus in accordance with one of claims 1 4 to 23 

means for maintaining a record in a crypto- further comprising: - .\ * . . . >: 

graphically, secure manner to indicate the amount of means for cryptographically authenticating at 

unused preview time remaining for said corjsumer is tea_st ttie portion of said.dataihat identifies whether 
to view said service during said fixed periqd. , a preview is available foi? said service. 

1 7. Apparatus in accordance with one of cfcims^ to 16 25. Apparatus in accordance with one of claims 1 4 to 24 
further comprising: . 0 .. % wherein said fixed period is enforced in a: .crypto- 

me,ans -for .maintaining yp. to N ^records of 20 , graphically secure manner. . - ; 
active Reviewable services at a tirr^, each »Fecprd . : - >< 

comprising either a purchase r^cprd representing a 

previewable service that has beer\ purchased by . • -„ <?v 

said consumer or a preview record representing a 

service that said consumer has select^d-for previews 2s ■ i ;< ^ / 

anc * i< ,*? >■'■/. "u* •-:? .r.i;: : -+ x?r 1 '.v. ■' ■. n . \;;*~ .. 

r : means iorj^ of an 

prdkfl^^aJt^V- SQ^ic^,r^c^ igijy ^Rrpg^arg 13 -t 0 ^v, ; y>z x oc^^v- 

epoch for the service represented by that^cord, is v; • ^- i > : . . t .?.t 

over. 30 : - ■ .. ^ yr ■■■ \ 

1 8. Apparatus in accordance with daim; JJ further qom- ~\? r; -.1.- * ' ^ • ,^ / . - 
prising: ■ ^ i r.- . J: ,.;••<.; - . - ,- 

. v means for preventing $e£rasur§ of aaypre-: ~. .■.,*/: 

view' record until the program epoch for the service 35 

represented thereby is over. , r;r , i#: r , . :r -: t > 

19. Apparatus in arcortanceyrith ^ r . r A - . . , 
Prising: ** •" , , ■.. r. • v 
i( means for converting a preview reccjd to a <o - ; , 
pujcchase r^coixj upop purchase^ . ■ j. : 
the ^ service represented by ttie preview record; and . . t . ' > . .. 

, ^ means for rendering the fwrQh^serecprdpro- . . a - • ? i • ; 

videdTby said. everting n^ns irrevocable^ s , " -.^3 ; - 

20. Apparatus in accoi^aTOewi^cl^i^ iit . - . - . r 
prising:. r ^-\[\ t - : j'^tctI- -,r; ; • m- ; :; • - ; ; . 

means for preveriting,tr^e §rasur^ of any pre- . ••<£ ^ 

vie^v record until the program epocji for ifie service 

represent^thereby is overn^ccjef^by QQnyersi<^i to so , , ; • . ^ 

an irrevocable purchase recof§l^., r v;> v . , ... • ,, r r - r - v - , ; - , 

21 . Apparatus in accordance with one pf daimsj 7 to 20 -s- r ... 
further comprising: r . , -1 . j - ... . i2 f t K r _ rV .» . , 

^ ,,mear^ for denying any additional pareyiews or ss V: . *• ■. , : ...-.« 

previewable services to said consumer whenever all [' ^ ^ :< 

N previewable service reaprds are active. : : ■-. 
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(54) Method and apparatus for free previews 



(57) Limited duration previews of proQraim offerings 
available for purchase via a communication network are ... 
provided in a cryptographically, secure manner at virtu- ' 
ally any time during the service, th^ invention ha$ par- 
ticular applicability to the provision of video services on 
a pay-per-view basis.' Such a video service" is provided 
during a program epoch (PE): A fixed period (72-74) is 
defined during the program epoch (72-78) wtien por- ' 
tions of the video service are available for viewing on a ; 
preview basis. A consumer is allowed to preview, with-1 1 
out purchase, portions of the video service at any time 
during the fixed period for up to maximunrrprevie«r 
duration (82) that is shorter than the,fix6d period (72- 
74), The consumer can then purchase the video service 
for viewing during the. program epoch (72-78) after pre- 
viewing portions thereof. A plurality of records (90, 92, 
94, 96, 98) is maintained to service different previewa- 
ble programs concurrently, — — ' 
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